Currently, different industries such as education, enterprise, government, military, operator, health care, and finance have different security requirements. At present, products used in all industries have met a normal security requirement, but scarcely meet a high-level security requirement.
Access control is one of the security requirement, and includes discretionary access control and mandatory access control. A security standard such as GB17859-1999 specifies that a security system with three or more levels need to use the mandatory access control. The mandatory access control is an industry threshold for protecting core content of the military industry, the government, and the like, and is a future development direction of the access control.
The discretionary access control is currently implemented in multiple types of operating systems. The discretionary access control in the existing multiple types of operating systems is often implemented by using discretionary access control similar to that of a Linux operating system. The discretionary access control means that an owner of an object can determine permission to access the object by others. The Linux operating system implements discretionary access control that is based on a “permission bit”. The permission bit is divided into three categories: “owner”, “group”, and “other”. When a user determines to transmit an object message to another user, the user can select only permission of “group” or “other”, and this is similar to a sharing strategy. A discretionary access control mechanism based on the permission bit has coarse granularity, and cannot be adapted to a scenario with relatively strict security. The mandatory access control requires allocating security classifications to a subject and an object in a system. When the subject requests an access to the object, the system performs permission (readable/writable) determining according to the security classifications of the subject and the object and an access type.
During implementation of the mandatory access control at an operating system layer, a kernel mechanism usually needs to be modified, and a difference between different systems also needs to be considered. Consequently, the implementation is extremely difficult. Currently, there are undiversified manners for implementing the mandatory access control, and only some customized systems implement the mandatory access control. SELinux is a security enhancement module developed based on Linux. By modifying a kernel and user space and expanding an existing GNU/Linux operating system, mandatory access control based on a type enforce (TE) strategy is implemented. For each access, the SELinux makes labels for an access subject and object by modifying kernel mode code of the GNU/Linux operating system, so that a program implements the mandatory access control over each access according to the labels. The solution is implemented by modifying the kernel mode code of the GNU/Linux operating system, and cannot be applied to another operating system. Therefore, an SELinux access is not supported in a Windows operating system, and the solution brings a 5% to 10% performance loss to the GNU/Linux operating system.